typedef NTSTATUS (NTAPI*NTDELAYEXECUTION)(BOOL,PLARGE_INTEGER);
typedef HANDLE (NTAPI* GETCSRPROCESSID)(void);
typedef void  (NTAPI* RTLEXITUSERTHREAD)(NTSTATUS);
typedef void  (NTAPI*RTLCAPTURECONTEXT)(CONTEXT*);
typedef void *(NTAPI*RTLALLOCATEHEAP)(HANDLE,ULONG,SIZE_T);
typedef void *(NTAPI*RTLENCODEPOINTER)(PVOID);
typedef NTSTATUS (NTAPI*RTLENTERCRITICALSECTION)(PRTL_CRITICAL_SECTION);
typedef NTSTATUS (NTAPI*RTLLEAVECRITICALSECTION)(PRTL_CRITICAL_SECTION);			  
typedef void (NTAPI* SINSRVCLIENTCONNECTSERVER)(void);
typedef NTSTATUS (NTAPI* NTQUERYSYSTEMINFORMATION)(SYSTEM_INFORMATION_CLASS,PVOID,ULONG,PULONG);
typedef NTSTATUS (NTAPI* NTSUSPENDTHREAD)(HANDLE,PULONG);
typedef NTSTATUS (NTAPI* NTOPENTHREAD)(PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES,PCLIENT_ID);

typedef struct _JMP_TRAILS
{
	_JMP_TRAILS *Next;
	ULONG_PTR CCPATH;
	ULONG_PTR ACPATH;
	ULONG InstLen;
	BYTE * InstOp;
}JMP_TRAILS;

typedef struct _SYSTEM_THREAD_INFORMATION
{
  LARGE_INTEGER           KernelTime;
  LARGE_INTEGER           UserTime;
  LARGE_INTEGER           CreateTime;
  ULONG                   WaitTime;
  PVOID                   StartAddress;
  CLIENT_ID               ClientId;
  KPRIORITY               Priority;
  LONG                    BasePriority;
  ULONG                   ContextSwitchCount;
  ULONG                   State;
  PVOID            WaitReason;
}SYSTEM_THREAD_INFORMATION, *PSYSTEM_THREAD_INFORMATION;

typedef struct _SYSTEM_PROCESS_INFORMATIONEX
{
  ULONG                   NextEntryOffset;
  ULONG                   NumberOfThreads;
  LARGE_INTEGER           Reserved[3];
  LARGE_INTEGER           CreateTime;
  LARGE_INTEGER           UserTime;
  LARGE_INTEGER           KernelTime;
  UNICODE_STRING          ImageName;
  KPRIORITY               BasePriority;
  HANDLE                  UniqueProcessId;
  HANDLE                  InheritedFromProcessId;
  ULONG                   HandleCount;
  ULONG                   Reserved2[2];
  ULONG                   PrivatePageCount;
  //VM_COUNTERS             VirtualMemoryCounters;
  IO_COUNTERS             IoCounters;
  SYSTEM_THREAD_INFORMATION           Threads[1];
}SYSTEM_PROCESS_INFORMATION_EX, *PSYSTEM_PROCESS_INFORMATION_EX;

typedef struct _SYSTEM_HANDLE_INFORMATION 
{
	USHORT ProcessId;
	USHORT CreatorBackTraceIndex;
	UCHAR ObjectTypeNumber;
	UCHAR Flags;
	USHORT Handle;
	PVOID Object;
	ACCESS_MASK GrantedAccess;
}SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;

typedef struct _SYSTEM_HANDLE_INFORMATION_EX
{
	ULONG NumberOfHandles;
	SYSTEM_HANDLE_INFORMATION Information[1];
}SYSTEM_HANDLE_INFORMATION_EX, *PSYSTEM_HANDLE_INFORMATION_EX;

typedef enum _SIN32_OBJECT_TYPE
{
		OB_TYPE_UNKNOWN = 0, OB_TYPE_TYPE = 1, OB_TYPE_DIRECTORY,
        OB_TYPE_SYMBOLIC_LINK,  OB_TYPE_TOKEN,  OB_TYPE_PROCESS,
        OB_TYPE_THREAD, /*OB_TYPE_UNKNOWN_7,*/ OB_TYPE_EVENT,
        OB_TYPE_EVENT_PAIR, OB_TYPE_MUTANT, //OB_TYPE_UNKNOWN_11,
        OB_TYPE_SEMAPHORE, OB_TYPE_TIMER, OB_TYPE_PROFILE,
        OB_TYPE_WINDOW_STATION, OB_TYPE_DESKTOP, OB_TYPE_SECTION,
        OB_TYPE_KEY, OB_TYPE_PORT, OB_TYPE_WAITABLE_PORT,
        /*OB_TYPE_UNKNOWN_21, OB_TYPE_UNKNOWN_22, OB_TYPE_UNKNOWN_23,
        OB_TYPE_UNKNOWN_24,*/ OB_TYPE_JOB, //22 on Whistler
        //OB_TYPE_CONTROLLER, OB_TYPE_DEVICE, OB_TYPE_DRIVER,
        OB_TYPE_IO_COMPLETION, OB_TYPE_FILE, OB_TYPE_WMI_GUID
}SIN32_OBJECT_TYPE;


typedef struct _DEBUG_MODULE_INFORMATION
{
	ULONG  Reserved[2];
	ULONG  Base;
	ULONG  Size;
    ULONG  Flags;
	USHORT Index;
	USHORT Unknown;
	USHORT LoadCount;
	USHORT ModuleNameOffset;
	CHAR   ImageName[256];
}DEBUG_MODULE_INFORMATION, *PDEBUG_MODULE_INFORMATION;

typedef struct _DEBUG_MODULE_INFORMATIONEX
{
	ULONG Count;
	DEBUG_MODULE_INFORMATION DbgModInfo[1];
}DEBUG_MODULE_INFORMATIONEX,*PDEBUG_MODULE_INFORMATIONEX;

typedef struct _DEBUG_BUFFER 
{
	HANDLE SectionHandle;
	PVOID  SectionBase;
	PVOID  RemoteSectionBase;
	ULONG  SectionBaseDelta;
	HANDLE  EventPairHandle;
	ULONG  Unknown[2];
	HANDLE  RemoteThreadHandle;
	ULONG  InfoClassMask;
	ULONG  SizeOfInfo;
	ULONG  AllocatedSize;
	ULONG  SectionSize;
	PDEBUG_MODULE_INFORMATIONEX  ModuleInformation;
	PVOID  BackTraceInformation;
	PVOID  HeapInformation;
	PVOID  LockInformation;
	PVOID  Reserved[8];
}DEBUG_BUFFER, *PDEBUG_BUFFER;

// RtlQueryProcessDebugInformation.DebugInfoClassMask constants
#define PDI_MODULES                       0x01
#define PDI_BACKTRACE                     0x02
#define PDI_HEAPS                         0x04
#define PDI_HEAP_TAGS                     0x08
#define PDI_HEAP_BLOCKS                   0x10
#define PDI_LOCKS                         0x20

typedef enum HWBRK_TYPE
{
	HWBRK_TYPE_CODE,
	HWBRK_TYPE_READWRITE,
	HWBRK_TYPE_WRITE,
};

typedef enum HWBRK_SIZE
{
	HWBRK_SIZE_1,
	HWBRK_SIZE_2,
	HWBRK_SIZE_4,
	HWBRK_SIZE_8,
};
typedef struct _HWBRK
{
		void* BreakAddress;
		HANDLE hThread;
		HWBRK_TYPE Type;
		HWBRK_SIZE Size;
		HANDLE hEvent;
		int iReg;
		int Opr;
		bool SUCC;

		_HWBRK()
		{
			Opr = 0;
			BreakAddress = 0;
			hThread = 0;
			hEvent = 0;
			iReg = 0;
			SUCC = false;
		}
}HWBRK;

typedef struct {
       ULONG            Unknown[21];
       UNICODE_STRING   CommandLine;
       UNICODE_STRING   ImageFile;
}ENVIRONMENT_INFORMATION, *PENVIRONMENT_INFORMATION;

typedef struct {
       ULONG                     Unknown[3];
       PENVIRONMENT_INFORMATION  Environment;
}STARTUP_ARGUMENT, *PSTARTUP_ARGUMENT;

typedef struct _SB_CONNECTION_REQUEST {
  ULONG SbImageType; 
  WCHAR SbApiPortName[120];
} SB_CONNECTION_REQUEST, *PSB_CONNECTION_REQUEST;

typedef struct _TreeTrunk
{
	void * MemStart;
	DWORD  MemTotalSize;
	DWORD  NumTotalEntry;
	DWORD  NumEntry;
}TreeTrunk;

typedef struct _SECTION_BASIC_INFORMATION
{ // Information Class 0
	PVOID BaseAddress;
	ULONG Attributes;
	LARGE_INTEGER Size;
}SECTION_BASIC_INFORMATION, *PSECTION_BASIC_INFORMATION;

typedef struct _LDR_MODULE 
{
	LIST_ENTRY InLoadOrderModuleList;  //<-- InLoad points here
	LIST_ENTRY InMemoryOrderModuleList; //<-- PInMem points here
	LIST_ENTRY InInitializationOrderModuleList;  //<-- InInitia points here
	PVOID BaseAddress; 
	PVOID EntryPoint; 
	ULONG SizeOfImage; 
	UNICODE_STRING FullDllName; 
	UNICODE_STRING BaseDllName; 
	ULONG Flags; 
	SHORT LoadCount; 
	SHORT TlsIndex; 
	LIST_ENTRY HashTableEntry; 
	ULONG TimeDateStamp;
}LDR_MODULE, *PLDR_MODULE;



typedef enum HK_ROUTINE
{
	HKMOV,//local hooking method 
	HKCMPXCHG,//local hooking method
	HKPAGEGAURD,
	HKINT3,
	HKVIRTEXECUTE,//local hook bypass method
	HKHOOP,//local hook	bypass method
	HKINJECTCODE,//remote injection of code
	HKINJECTDLL,  //remote	injection of dll
	HKTHREADHIJACK,//RtlRemoteCall with Event Driven Wait routine 
	HKINJECTAPC//APC injection..
};
struct CLLHook
{
	SLIST_ENTRY HookEntry;
	bool        Installed;//0 is not installed 1 if installed
	BYTE        Opcode;//e9 jmp e8 call
	int         Index;
	LPVOID      pHeap;
	DWORD       TProcessId;//Targets ProcessId
	DWORD       hkTAddress;//Target Function to Hook
	DWORD       hkAddress;//Hook address
	PVOID       hkAllocAddr;
	DWORD       hkSz;//our hook size generally 5 bytes byte+dword
};
typedef CLLHook* PCLLHook;
typedef enum _MEMORY_INFORMATION_CLASS
{
	MemoryBasicInformation
} MEMORY_INFORMATION_CLASS, *PMEMORY_INFORMATION_CLASS;
typedef struct _RTL_VECTORED_EXCEPTION_HANDLER
{
	LIST_ENTRY ListEntry;
	PVECTORED_EXCEPTION_HANDLER VectoredHandler;
}RTL_VECTORED_EXCEPTION_HANDLER,*PRTL_VECTORED_EXCEPTION_HANDLER;

typedef struct _CSR_NT_SESSION
{
	ULONG ReferenceCount;
	LIST_ENTRY SessionList;
	ULONG SessionId;
}CSR_NT_SESSION, *PCSR_NT_SESSION;
 
typedef struct _CSR_PROCESS
{
	CLIENT_ID ClientId;
	LIST_ENTRY ListLink;
	LIST_ENTRY ThreadList;
	struct _CSR_PROCESS *Parent;
	PCSR_NT_SESSION NtSession;
	ULONG ExpectedVersion;
	HANDLE ClientPort;
	ULONG ClientViewBase;
	ULONG ClientViewBounds;
	HANDLE ProcessHandle;
	ULONG SequenceNumber;
	ULONG Flags;
	ULONG DebugFlags;
	CLIENT_ID DebugCid;
	ULONG ReferenceCount;
	ULONG ProcessGroupId;
	ULONG ProcessGroupSequence;
	ULONG fVDM;
	ULONG ThreadCount;
	ULONG PriorityClass;
	ULONG Reserved;
	ULONG ShutdownLevel;
	ULONG ShutdownFlags;
	PVOID ServerData[ANYSIZE_ARRAY];
} CSR_PROCESS, *PCSR_PROCESS;

typedef struct _CSR_THREAD
{
    LARGE_INTEGER CreateTime;
    LIST_ENTRY Link;
    LIST_ENTRY HashLinks;
    CLIENT_ID ClientId;
    PCSR_PROCESS Process;
    struct _CSR_WAIT_BLOCK *WaitBlock;
    HANDLE ThreadHandle;
    ULONG Flags;
    ULONG ReferenceCount;
    ULONG ImpersonationCount;
}CSR_THREAD, *PCSR_THREAD;
typedef struct _CSR_SERVER_DLL
{
    ULONG Length;
    HANDLE Event;
    ANSI_STRING Name;
    HANDLE ServerHandle;
    ULONG ServerId;
	ULONG Unknown;
    ULONG ApiBase;
    ULONG HighestApiSupported;
    ULONG *DispatchTable;
    PBOOLEAN ValidTable;
    PCHAR *NameTable;
    ULONG SizeOfProcessData;
   /* PCSR_CONNECT_CALLBACK*/ULONG *ConnectCallback;
   /* PCSR_DISCONNECT_CALLBACK*/ULONG *DisconnectCallback;
   /* PCSR_HARDERROR_CALLBACK*/ULONG *HardErrorCallback;
    PVOID SharedSection;
   /* PCSR_NEWPROCESS_CALLBACK*/ULONG *NewProcessCallback;
   /* PCSR_SHUTDOWNPROCESS_CALLBACK*/ULONG *ShutdownProcessCallback;
    ULONG Unknown2[3];
  } CSR_SERVER_DLL, *PCSR_SERVER_DLL;

typedef struct _VEH_HIJACK_SETUP
{
	RTLALLOCATEHEAP Alloc;
	RTLENCODEPOINTER Encode;
	RTLENTERCRITICALSECTION CriticalEnter;
	RTLLEAVECRITICALSECTION CriticalLeave;
	ULONG RtlpVectoredExceptionLock;
	ULONG VehListHead;
	void *VectoredHandler;
}VEH_HIJACK_SETUP,*PVEH_HIJACK_SETUP;

typedef struct _SIN_CLIENT_HOOK_INFO
{
	PVOID Handler;
	ULONG NumTargets;
	ULONG NumHooks;
	ULONG NumInt3;
}SIN_CLIENT_HOOK_INFO;

typedef struct _SIN_CLIENT_ENTRY
{
	LIST_ENTRY ClientList;
	HANDLE Process;
	HANDLE ProcessId;
	HANDLE ServerThread;
	HANDLE ThreadId;
	HANDLE ClientPort;
	PORT_VIEW ServerView;
	REMOTE_PORT_VIEW ClientView;
	SIN_CLIENT_HOOK_INFO HookInfo;
}SIN_CLIENT_ENTRY,PSIN_CLIENT_ENTRY;
 
typedef struct _SIN_CLIENT_CONNECT
{
     ULONG ServerId;
     PVOID ClientInfo;
     ULONG ClientInfoSize;
}SIN_CLIENT_CONNECT,*PSIN_CLIENT_CONNECT;

typedef enum _SIN_API_TYPE
{
	SIN_INJECT_CLIENT = 1,
	SIN_INJECT_DLL,
	SIN_INJECT_MEMORY,
	SIN_MAP_CODE,
	SIN_MAP_RUN_CODE,
	SIN_REMOTE_HOOK,
	SIN_REMOTE_VEH_TAKEOVER,
	SIN_SUSPEND_CLIENT,
	SIN_WAIT_SERVER
}SIN_API_TYPE;

typedef struct _SIN_REQUEST_INJECT_CLIENT
{
	char			ProcessName[50];
}SIN_REQUEST_INJECT_CLIENT,*PSIN_REQUEST_INJECT_CLIENT;

typedef struct _SIN_REQUEST_INJECT_DLL
{
	char				ProcessName[50];
	char				DllPath[50];
}SIN_REQUEST_INJECT_DLL,*PSIN_REQUEST_INJECT_DLL;

typedef struct _SIN_REQUEST_REMOTE_HOOK
{
	CLLHook				HookMsg;	
	char				ProcessName[50];
}SIN_REQUEST_REMOTE_HOOK,*PSIN_REQUEST_REMOTE_HOOK;

typedef struct _SIN_REQUEST_VEH_TAKEOVER
{
	ULONG				HandleExceptionType;
	ULONG				TargetFunc;
	ULONG               HookFunc;	
	char				ProcessName[50];
}SIN_REQUEST_VEH_TAKEOVER,*PSIN_REQUEST_VEH_TAKEOVER;

typedef struct _SIN_API_MESSAGE
{
   PORT_MESSAGE Header;
   ULONG Data;
   ULONG Status;
   ULONG StartAddress;
   ULONG ApiType;
   SIN_CLIENT_ENTRY ClientInfo;
   union
   {
	   SIN_REQUEST_VEH_TAKEOVER ReqVehHook;
	   SIN_REQUEST_REMOTE_HOOK	 ReqRemoteHook;
	   SIN_REQUEST_INJECT_DLL   ReqDllInject;
	   SIN_REQUEST_INJECT_CLIENT ReqInjectClient;
   }ApiInfo;
}SIN_API_MESSAGE, *PSIN_API_MESSAGE;

typedef struct _SUSPEND_OTHERS
{
	RTLALLOCATEHEAP sAllocateHeap;
	NTQUERYSYSTEMINFORMATION sQuerySystemInformation;
	NTSUSPENDTHREAD sSuspendThread;
	NTOPENTHREAD sOpenThread;
	PVOID Buffer;
	CLIENT_ID ClientId;
}SUSPEND_OTHERS,*PSUSPEND_OTHERS;

